feat: matrix ci (#2014)

.github/workflows/docker-image-arm64.yml

-name: Publish Docker image (Multi Registries)
+name: Publish Docker image (Multi Registries, native amd64+arm64)
 
 
 on:
 on:
   push:
   push:
     tags:
     tags:
       - '*'
       - '*'
+
 jobs:
 jobs:
-  push_to_registries:
-    name: Push Docker image to multiple registries
-    runs-on: ubuntu-latest
+  build_single_arch:
+    name: Build & push (${{ matrix.arch }}) [native]
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: amd64
+            platform: linux/amd64
+            runner: ubuntu-latest
+          - arch: arm64
+            platform: linux/arm64
+            runner: ubuntu-24.04-arm
+    runs-on: ${{ matrix.runner }}
+
     permissions:
     permissions:
       packages: write
       packages: write
       contents: read
       contents: read
+
     steps:
     steps:
-      - name: Check out the repo
+      - name: Check out (shallow)
         uses: actions/checkout@v4
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
 
 
-      - name: Save version info
+      - name: Resolve tag & write VERSION
         run: |
         run: |
-          git describe --tags > VERSION 
+          git fetch --tags --force --depth=1
+          echo "TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
+          echo "$TAG" > VERSION
+          echo "Building tag: $TAG for ${{ matrix.arch }}"
+
 
 
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+      - name: Normalize GHCR repository
+        run: echo "GHCR_REPOSITORY=${GITHUB_REPOSITORY,,}" >> $GITHUB_ENV
 
 
       - name: Set up Docker Buildx
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
         uses: docker/setup-buildx-action@v3
@@ -31,26 +50,85 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
 
-      - name: Log in to the Container registry
+      - name: Log in to GHCR
         uses: docker/login-action@v3
         uses: docker/login-action@v3
         with:
         with:
           registry: ghcr.io
           registry: ghcr.io
           username: ${{ github.actor }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
 
-      - name: Extract metadata (tags, labels) for Docker
+      - name: Extract metadata (labels)
         id: meta
         id: meta
         uses: docker/metadata-action@v5
         uses: docker/metadata-action@v5
         with:
         with:
           images: |
           images: |
             calciumion/new-api
             calciumion/new-api
-            ghcr.io/${{ github.repository }}
+            ghcr.io/${{ env.GHCR_REPOSITORY }}
 
 
-      - name: Build and push Docker images
-        uses: docker/build-push-action@v5
+      - name: Build & push single-arch (to both registries)
+        uses: docker/build-push-action@v6
         with:
         with:
           context: .
           context: .
-          platforms: linux/amd64,linux/arm64
+          platforms: ${{ matrix.platform }}
           push: true
           push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
+          tags: |
+            calciumion/new-api:${{ env.TAG }}-${{ matrix.arch }}
\ No newline at end of file
+            calciumion/new-api:latest-${{ matrix.arch }}
+            ghcr.io/${{ env.GHCR_REPOSITORY }}:${{ env.TAG }}-${{ matrix.arch }}
+            ghcr.io/${{ env.GHCR_REPOSITORY }}:latest-${{ matrix.arch }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          provenance: false
+          sbom: false
+
+  create_manifests:
+    name: Create multi-arch manifests (Docker Hub + GHCR)
+    needs: [build_single_arch]
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/')
+    steps:
+      - name: Extract tag
+        run: echo "TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Create & push manifest (Docker Hub - version)
+        run: |
+          docker buildx imagetools create \
+            -t calciumion/new-api:${TAG} \
+            calciumion/new-api:${TAG}-amd64 \
+            calciumion/new-api:${TAG}-arm64
+
+      - name: Create & push manifest (Docker Hub - latest)
+        run: |
+          docker buildx imagetools create \
+            -t calciumion/new-api:latest \
+            calciumion/new-api:latest-amd64 \
+            calciumion/new-api:latest-arm64
+
+      # ---- GHCR ----
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Create & push manifest (GHCR - version)
+        run: |
+          docker buildx imagetools create \
+            -t ghcr.io/${GHCR_REPOSITORY}:${TAG} \
+            ghcr.io/${GHCR_REPOSITORY}:${TAG}-amd64 \
+            ghcr.io/${GHCR_REPOSITORY}:${TAG}-arm64
+
+      - name: Create & push manifest (GHCR - latest)
+        run: |
+          docker buildx imagetools create \
+            -t ghcr.io/${GHCR_REPOSITORY}:latest \
+            ghcr.io/${GHCR_REPOSITORY}:latest-amd64 \
+            ghcr.io/${GHCR_REPOSITORY}:latest-arm64